8.
E1
Tx
A1
A2
A3
Ty
A1
A4
A5
indexed. While previous works [2, 4] employed a forked version of bitcointools 4
, the newer bitcoin clients
indexed the full blockchain using LevelDB instead making the publicly available bitcointools obsolete.
Instead, we used Armory 5
to parse through the blockchain, and wrote wrapper classes that extracted the
relevant information required to construct the transaction graph.
5.1.2 Web Scraping
Many users, in particular early adopters, are interested in driving bitcoin use into more mainstream public
use. One way they do this is to try to encourage transactions. A common practice is to attach a bitcoin
address as a signature to emails or forum posts. In forum posts especially, users contribute to the community,
for example with new mining software or a tutorial on how to get set up to use bitcoins, and leave their
address in the signature block. They expect to receive tips from forum readers that ﬁnd their post helpful.
This practice created a natural attack vector to the anonymity of the block chain. We can easily tie user
information to transactions in the block chain.
We used a python package called Scrapy6
to fetch and parse the forum pages(ﬁg. 3). We wrote a spider
that crawls bitcointalk.org in a breadth-ﬁrst manner looking for post signatures that might contain bitcoin
addresses (i.e. it matched the regular expression r‘1.{26,33}’). We then took this string and veriﬁed that it
was a legitimate bitcoin public key (bitcoin addresses include a built-in checksum) to avoid attempting to
annotate a large number nodes that can’t possibly appear in the blockchain.
Figure 3: A typical user signature line that includes a bitcoin address for ‘tipping’.
We were able to ﬁnd a large number of forum users that can be directly linked to their keys in the
transaction graph. We ran the scraping code for just under 30 hours. During this time we followed links
up to four deep from the home page. This covered a total of 44,086 pages and 89,088 posts that included a
A3
Cross-reference block chain
and external data
(cf. Fleder et al. 2015)8

9.
E1
Tx
A1
A2
A3
Ty
A1
A4
A5
indexed. While previous works [2, 4] employed a forked version of bitcointools 4
, the newer bitcoin clients
indexed the full blockchain using LevelDB instead making the publicly available bitcointools obsolete.
Instead, we used Armory 5
to parse through the blockchain, and wrote wrapper classes that extracted the
relevant information required to construct the transaction graph.
5.1.2 Web Scraping
Many users, in particular early adopters, are interested in driving bitcoin use into more mainstream public
use. One way they do this is to try to encourage transactions. A common practice is to attach a bitcoin
address as a signature to emails or forum posts. In forum posts especially, users contribute to the community,
for example with new mining software or a tutorial on how to get set up to use bitcoins, and leave their
address in the signature block. They expect to receive tips from forum readers that ﬁnd their post helpful.
This practice created a natural attack vector to the anonymity of the block chain. We can easily tie user
information to transactions in the block chain.
We used a python package called Scrapy6
to fetch and parse the forum pages(ﬁg. 3). We wrote a spider
that crawls bitcointalk.org in a breadth-ﬁrst manner looking for post signatures that might contain bitcoin
addresses (i.e. it matched the regular expression r‘1.{26,33}’). We then took this string and veriﬁed that it
was a legitimate bitcoin public key (bitcoin addresses include a built-in checksum) to avoid attempting to
annotate a large number nodes that can’t possibly appear in the blockchain.
Figure 3: A typical user signature line that includes a bitcoin address for ‘tipping’.
We were able to ﬁnd a large number of forum users that can be directly linked to their keys in the
transaction graph. We ran the scraping code for just under 30 hours. During this time we followed links
up to four deep from the home page. This covered a total of 44,086 pages and 89,088 posts that included a
A3
Cross-reference block chain
and external data
(cf. Fleder et al. 2015)9

19.
19
Towards Risk Scoring of Bitcoin Transactions
Malte M¨oser, Rainer B¨ohme, and Dominic Breuker
Department of Information Systems, University of M¨unster, Germany
Abstract. If Bitcoin becomes the prevalent payment system on the In-
ternet, crime ﬁghters will join forces with regulators and enforce black-
listing of transaction preﬁxes at the parties who oﬀer real products and
services in exchange for bitcoin. Blacklisted bitcoins will be hard to spend
and therefore less liquid and less valuable. This requires every recipient of
Bitcoin payments not only to check all incoming transactions for possible
blacklistings, but also to assess the risk of a transaction being blacklisted
in the future. We elaborate this scenario, specify a risk model, devise a
prediction approach using public knowledge, and present preliminary re-
sults using data from selected known thefts. We discuss the implications
on markets where bitcoins are traded and critically revisit Bitcoin’s abil-
ity to serve as a unit of account.
1 Introduction
Whenever a merchant receives a 100-dollar note, she is well advised to carefully